dashboard: point frontend at the /api/* backend routes

Phase 2 of the dashboard route consolidation. The backend now double-registers
every bare top-level route (approve/deny/kill/restart/start/rebuild/destroy/
update-all/answer-question/cancel-question/purge-tombstone/matrix-account-login/
cancel-reminder/retry-reminder/request-spawn/op-send/meta-update/dashboard-stream/
dashboard-history) at an additional /api/<same> path. Switch every dashboard-pkg
fetch / EventSource / form action to the /api/ form so "backend = /api/*" holds
on the frontend side too.

Bare paths still answer, so this is independently deployable; once it ships the
backend can drop the bare registrations (phase 3). webhook/knowledge stays a
distinct webhook prefix (forge-driven, no SPA caller). app.js's /rebuild,/start
are the agent harness UI (different server) and are untouched.

Part of #1846 (phase 2).

frontend/packages/dashboard/src/core.js

@@ -51,7 +51,7 @@ function renderMetaInputs(s) {
   }
   const f = el('form', {
     method: 'POST',
-    action: '/meta-update',
+    action: '/api/meta-update',
     class: 'meta-inputs-form',
     'data-async': '',
     'data-no-refresh': '',
@@ -331,7 +331,7 @@ function renderTombstones(s) {
 
     const actions = el('div', { class: 'actions' });
     const respawn = el('form', {
-      method: 'POST', action: '/request-spawn',
+      method: 'POST', action: '/api/request-spawn',
       class: 'inline', 'data-async': '',
       'data-confirm': 'queue spawn approval for ' + t.name + '? state will be reused.',
     });
@@ -341,7 +341,7 @@ function renderTombstones(s) {
     );
     actions.append(respawn);
     actions.append(form(
-      '/purge-tombstone/' + t.name, 'btn-destroy', 'PURG3',
+      '/api/purge-tombstone/' + t.name, 'btn-destroy', 'PURG3',
       'PURGE ' + t.name + '? config history, claude creds, '
       + 'and notes are all WIPED. no undo.',
       {}, { noRefresh: true },
@@ -545,7 +545,7 @@ async function init() {
 
   await refreshState();
 
-  const es = openStream('/dashboard/stream');
+  const es = openStream('/api/dashboard/stream');
   if (es) {
     es.onmessage = (e) => {
       let ev;